Rick and Morty Cosmic Heads Live Wallpaper

AI Security Review

Evidence context: threat category pup; evidence quality moderate.

The extension 'Rick and Morty Cosmic Heads Live Wallpaper' exhibits concerning network behavior patterns. The IoC extractor identified 610 domains, including ƽv.wf, k.id, p.gm, ɡ.kz, 6.gi, vl.kn, b.er, w.km, and ԕ.vc. These domains follow a suspicious pattern of single-character subdomains across various TLDs, which is a known signature for ad injection networks and monetization infrastructure rather than legitimate services.

Network activity is present in three files: js/newsBar.js:17 contains a fetch call, js/script.js:45 contains a fetch call, and js/popup.js:29 contains a fetch call. The file name 'newsBar.js' suggests the extension may inject news or content bars, a common PUP behavior. The extension description claims to provide 'dynamic HD Rick and Morty cosmic scenes' for new tabs, which aligns with browser hijacking functionality that replaces the new tab page.

The developer attribution is limited to [email protected] with no company name or verified publisher status. The extension has zero users, making it impossible to assess real-world behavior or community trust.

No malware signatures were detected in any files. No obfuscation findings were present. The 34 code-smell findings are all low severity and match known false positive patterns per CVEQ guidelines.

The strongest counterargument is that the 610 IoC domains could be false positives from the XIOC extractor misreading hex substrings as domains. The non-ASCII characters in domains like ƽv.wf, ɡ.kz, and ԕ.vc could represent hex fragments from minified JavaScript. However, this does not explain the single-character subdomain pattern (k.id, b.er, p.gm, 6.gi, w.km) which are genuine domain structures, not hex strings. These specific patterns are not in the known false positive categories (CDNs, analytics, Google/Microsoft infrastructure). The combination of suspicious domain patterns, new tab page functionality, and anonymous developer attribution indicates this extension likely participates in adware/PUP monetization networks, warranting a confirmed_risk verdict despite the absence of malware signatures.

Key Reasons

• 610 IoC domains with suspicious single-character subdomain patterns
• No malware signatures or obfuscation detected
• Anonymous developer with email-only attribution
• Network calls in js/newsBar.js suggesting content injection
• New tab page replacement functionality per description

False Positive Considerations

• code-smell findings (low severity)
• potential IoC extractor hex substring misreads

Reviewed 2026-04-27; recommended action: monitor; model confidence 75%.